#!/usr/bin/python

from pwn import *

context.log_level = 'critical'

proc = remote('crypto.byteband.it', 7004)
proc.recvuntil(":\n")
proc.sendline('3')
proc.recvuntil(':\n')

enc_flag = proc.recvline().strip()

flag_blocks = []

for i in range(0, len(enc_flag), 32):
    flag_blocks.append(enc_flag[i:i+32])

flag = [0]*(len(flag_blocks) - 1)

for i in range(len(flag)):
    flag[i] = ['?']*16

for i in range(len(flag_blocks) - 2):
    b1 = list(flag_blocks[i].decode('hex'))
    b2 = list(flag_blocks[i + 1].decode('hex'))

    b1_copy = [x for x in b1]
    pos = 15
    
    while pos >= 0:
        for ch in range(256):
            b1[pos] = chr(ch ^ ord(b1_copy[pos]) ^ (16 - pos))
            ct = (''.join(b1) + ''.join(b2)).encode('hex')
            proc.recvuntil(":\n")
            proc.sendline("2")
            proc.recvuntil(":\n")
            proc.sendline(ct)
            proc.recvline()
            prompt = proc.recvline()
            if '!' in prompt:
                flag[i][pos] = chr(ch)
                print chr(ch)
                for j in range(pos, 16):
                    b1[j] = chr(ord(b1_copy[j]) ^ (16 - pos + 1) ^ ord(flag[i][j]))

                pos -= 1
                break

b1 = list(flag_blocks[-2].decode('hex'))
b2 = list(flag_blocks[-1].decode('hex'))

b1_copy = [x for x in b1]

for i in range(16):
    b1[i] = 'A'
    ct = (''.join(b1) + ''.join(b2)).encode('hex')
    proc.recvuntil(":\n")
    proc.sendline("2")
    proc.recvuntil(":\n")
    proc.sendline(ct)
    proc.recvline()
    prompt = proc.recvline()
    b1[i] = b1_copy[i]
    if '?' in prompt:
        pos = i - 1
        break

pad_value = 16 - pos - 1
for i in range(pos + 1, 16):
    b1[i] = chr(ord(b1_copy[i]) ^ (16 - pos) ^ (16 - pos - 1))
    flag[-1][i] = chr(16 - pos - 1)

while pos >= 0:
        for ch in range(256):
            b1[pos] = chr(ch ^ ord(b1_copy[pos]) ^ (16 - pos))
            ct = (''.join(b1) + ''.join(b2)).encode('hex')
            proc.recvuntil(":\n")
            proc.sendline("2")
            proc.recvuntil(":\n")
            proc.sendline(ct)
            proc.recvline()
            prompt = proc.recvline()
            if '!' in prompt:
                flag[-1][pos] = chr(ch)
                for j in range(pos, 16):
                    b1[j] = chr(ord(b1_copy[j]) ^ (16 - pos + 1) ^ ord(flag[-1][j]))

                pos -= 1
                break
            # print pos

result = ''

for l in flag:
    result += ''.join(l)

print result[:-pad_value].decode('hex')